Who Really Owns Your Health Data? Open Standards, openEHR, and the Case Against Vendor Lock-In
— by Vivax
Before a hospital signs for its next information system, there is a quieter, more important question than price or features: who really owns the data once it…
In a widely-shared Medium essay — "Before You Buy Another Hospital Information System, Ask This Question: Who Really Owns Your Health Data?" — the author makes an argument every health-IT buyer should sit with. When a hospital procures an electronic health record, it is usually told it owns its data. In practice, the data lives inside a vendor's proprietary schema, accessible mainly through that vendor's tools, and exportable only in shapes that are awkward to reuse. Switching systems means paying to migrate — or simply losing years of clinical history. That is vendor lock-in, and in healthcare it is not a billing inconvenience; it is a patient-safety and continuity-of-care problem. The fix is not a better contract clause. It is an architecture where the clinical data is stored in an open, vendor-neutral format that outlives any single application — so the question "who owns the data?" finally has an honest answer: the hospital and its patients do.
That architecture has a name: openEHR. It is an open, non-profit standard — and a body of clinical models — for storing a lifelong, patient-centred health record independently of the application that happens to read or write it. Its defining idea is "two-level modelling": software engineers build a small, stable technical core, while clinicians define the actual clinical content as machine-readable "archetypes" — agreed specifications of concepts like a blood-pressure reading, a problem list, or a medication order. Those archetypes are authored and shared by the clinical community, not buried in a vendor's database. It is worth being precise here, because the standards are often confused: HL7 FHIR is an excellent standard for exchanging messages between systems, while openEHR is a standard for how the record is structured and persisted in the first place. They are complementary — FHIR moves data; openEHR governs the durable shape of the data being moved.
A standard only matters if you can actually run it, and this is where EHRbase comes in. EHRbase is the leading open-source openEHR server — an Apache-2.0-licensed clinical data repository that any hospital, vendor, or research group can deploy, inspect, and extend. Because it implements the openEHR specifications and their query language (AQL) faithfully, it turns the openEHR promise into a working backend: a place to store records in the open format, query them in a standard way, and never wonder what is happening inside a black box. Open-source at the data tier is what makes "you own your data" verifiable rather than aspirational — there is no proprietary lock on the most important asset a health system has.
Software alone, though, does not make an open-standards programme succeed; it takes expertise and governance, which is the role played by specialists like freshEHR. freshEHR is a clinical-informatics consultancy that helps health systems do openEHR properly — setting strategy, designing and curating archetypes and templates, mapping to terminologies like SNOMED CT, and supporting implementation and integration with HL7 and FHIR along the way. Their work is a reminder that interoperability is as much a human discipline as a technical one: archetypes have to be agreed, governed, versioned, and kept clinically faithful over time. Open standards give you the freedom to own your data; people and process are what turn that freedom into a maintainable, high-quality record.
This is the exact principle the Vivax open-source data platform is built on: that the foundation of medical AI must be open, owned by the hospital, and never locked inside a vendor's black box. Sitting in the data tier of our open medical AI stack, the Vivax Standardized Data Platform grades every record for quality and reliability, then cleans, validates, and harmonizes it into unified, structured data forms — and publishes those as open-source data archetypes that anyone can build on. We deliberately minimize the layers between the hardware, the record, and the model, and the clinical world model that learns from this data stays open-source at its foundation, with only the implementation and integration layer commercial on top. And because hospitals should never have to ship their patients' data anywhere to benefit from AI, the platform is designed for in-place federated learning with differential privacy and secure aggregation — the model travels to the data, not the other way around. Open standards like openEHR, open servers like EHRbase, and the governance ethos of teams like freshEHR all point to the same future we are building toward: one where the answer to "who owns your health data?" is never in doubt.